← Back to CRACKON CTF

MARTHA AND THE VOID

A Forensics challenge involving a LUKS encrypted disk image. Discover the decryption password hidden in the raw disk tail/slack space.

Tools Used

unzipfdiskcryptsetupPython

Overview

We are given a raw disk image that contains multiple partitions, one of which is a LUKS encrypted container. We must locate the password outside the filesystem to decrypt and mount the partition.

Reconnaissance

Extracting the zip archive yields quest.img.

$ fdisk -l quest.img
$ file quest.img

The file commands identify a LUKS encrypted container. The description hints at finding the key in the "space between sectors" or the "void".

Exploitation Strategy

Instead of attempting to crack the container, we inspect the raw disk trailing space or slack sectors.

Running a script to print the end of the disk image reveals the key:

$ tail -c 2048 quest.img
# Output string found: Th1ngs_fr0m_de3p_in_t1me_1983

We open the LUKS container with the discovered password and mount the device.

Solution Code

# 1. Unlock LUKS container
# cryptsetup luksOpen quest.img vault
# Enter password: Th1ngs_fr0m_de3p_in_t1me_1983
#
# 2. Mount filesystem
# mount /dev/mapper/vault /mnt
# Read /mnt/flag.txt

Flag

CrackOn{Th1ngs_fr0m_de3p_in_t1me_1983}